CVE-2004-1028

Untrusted execution path vulnerability in chcod on AIX IBM 5.1.0, 5.2.0, and 5.3.0 allows local users to execute arbitrary programs by modifying the PATH environment variable to point to a malicious "grep" program, which is executed from chcod...

CVE-2004-1270

lppasswd in CUPS 1.1.22, when run in environments that do not ensure that file descriptors 0, 1, and 2 are open when lppasswd is called, does not verify that the passwd.new file is different from STDERR, which allows local users to control output to passwd.new via certain user input that triggers...

UML_Utilities User-Mode Linux - uml_utilities 20030903 UML_Net Slip Network Interface Denial of Service

source: https://www.securityfocus.com/bid/12016/info The umlutilites umlnet application may permit unprivileged malicious local users to shut down the slip network interface. This is due to the program being installed setuid root by default. This vulnerability could be exploited to deny network...

XFree86 vulnerable to buffer overflow via error in 'ReadFontAlias()' function

Overview XFree86 contains a vulnerability in the parsing of the 'fonts.alias' file, which could be exploited by a local user to execute arbitrary code with elevated privileges. Description XFree86 contains a flaw during the processing of the 'fonts.alias' file. XFree86 is an implementation of the...

CVE-2004-0565

Floating point information leak in the context switch code for Linux 2.4.x only checks the MFH bit but does not verify the FPH owner, which allows local users to read register values of other processes by setting the MFH bit...

CVE-2004-0565

Floating point information leak in the context switch code for Linux 2.4.x only checks the MFH bit but does not verify the FPH owner, which allows local users to read register values of other processes by setting the MFH bit...

Altiris Deployment Solution 5.6 - Client Service Privilege Escalation

Altiris Deployment Solution 5.6 - Client Service Privilege Escalation source: https://www.securityfocus.com/bid/11709/info Altiris Deployment Solution Client allows a user to activate the client interface by easily launching the software from an icon in the Windows system tray. It is reported tha...

Mailtraq 2.x - Administration Console Privilege Escalation

Mailtraq 2.x - Administration Console Privilege Escalation source: https://www.securityfocus.com/bid/11708/info Mailtraq allows a user to activate the Mailtraq administration console software by easily launching the software from an icon in the Windows system tray. It is reported that a local use...

CVE-2004-1051

sudo before 1.6.8p2 allows local users to execute arbitrary commands by using "" style environment variables to create functions that have the same name as any program within the bash script that is called without using the program's full pathname...

Debian DSA-568-1 : cyrus-sasl-mit - unsanitised input

A vulnerability has been discovered in the Cyrus implementation of the SASL library, the Simple Authentication and Security Layer, a method for adding authentication support to connection-based protocols. The library honors the environment variable SASLPATH blindly, which allows a local user to...

CVE-2004-0211

The kernel for Microsoft Windows Server 2003 does not reset certain values in CPU data structures, which allows local users to cause a denial of service system crash via a malicious program...

CVE-2004-0884

The 1 libsasl and 2 libsasl2 libraries in Cyrus-SASL 2.1.18 and earlier trust the SASLPATH environment variable to find all available SASL plug-ins, which allows local users to execute arbitrary code by modifying the SASLPATH to point to malicious programs...

Important: Red Hat Security Advisory: ImageMagick security update

Updated ImageMagick packages that fix various security vulnerabilities are now available. ImageMagickTM is an image display and manipulation tool for the X Window System. A heap overflow flaw was discovered in the ImageMagick image handler. An attacker could create a carefully crafted BMP file in...

[SECURITY] [DSA 568-1] New cyrus-sasl-mit packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 568-1 [email protected] http://www.debian.org/security/ Martin Schulze October 16th, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 563-1] New cyrus-sasl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 563-1 [email protected] http://www.debian.org/security/ Martin Schulze October 12th, 2004 http://www.debian.org/security/faq -...

Debian DSA-369-1 : zblast - buffer overflow

Steve Kemp discovered a buffer overflow in zblast-svgalib, when saving the high score file. This vulnerability could be exploited by a local user to gain gid 'games', if they can achieve a high score. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Debian DSA-522-1 : super - format string vulnerability

Max Vozeler discovered a format string vulnerability in super, a program to allow specified users to execute commands with root privileges. This vulnerability could potentially be exploited by a local user to execute arbitrary code with root privileges. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-036-1 : Midnight Commander - arbitrary program execution

It has been reported that a local user could tweak Midnight Commander of another user into executing an arbitrary program under the user id of the person running Midnight Commander. This behaviour has been fixed by Andrew V. Samoilov. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-331-1 : imagemagick - insecure temporary file

imagemagick's libmagick library, under certain circumstances, creates temporary files without taking appropriate security precautions. This vulnerability could be exploited by a local user to create or overwrite files with the privileges of another user who is invoking a program using this librar...

Debian DSA-323-1 : noweb - insecure temporary files

Jakob Lell discovered a bug in the 'noroff' script included in noweb whereby a temporary file was created insecurely. During a review, several other instances of this problem were found and fixed. Any of these bugs could be exploited by a local user to overwrite arbitrary files owned by the user...